build(deps): bump @logtape/logtape from 2.4.0 to 2.4.1

[dependabot]

Bumps @logtape/logtape from 2.4.0 to 2.4.1.

Changelog

Sourced from @​logtape/logtape's changelog.

Version 2.4.1

Released on October 10, 2026.

@​logtape/logtape

• Fixed configureSync() rejecting synchronous disposable sinks and filters in browsers without Symbol.dispose or Symbol.asyncDispose, including Safari. Sinks and filters now retain their distinct cleanup hooks, preventing duplicate cleanup and asynchronous cleanup during resetSync(). Sink wrappers preserve these hooks, and disposable sinks also work with using and await using transpiled with registry-symbol fallbacks (Symbol.for("Symbol.dispose") and Symbol.for("Symbol.asyncDispose")). Scoped configurations now also preserve cleanup hooks and correctly distinguish synchronous and asynchronous resources in withConfig() and withConfigSync(). [#255, #257]

#255: dahlia/logtape#255 #257: dahlia/logtape#257

@​logtape/cloudwatch-logs

• Fixed CloudWatch Logs sinks losing their asynchronous cleanup hooks when Symbol.asyncDispose is unavailable. reset() now waits for buffered records to be flushed, and configureSync() correctly rejects these asynchronous sinks. [#255, #257]

@​logtape/file

• Fixed file sinks losing their cleanup hooks when Symbol.dispose or Symbol.asyncDispose is unavailable. Synchronous file sinks now work with configureSync(), and reset() invokes and awaits asynchronous cleanup, flushing buffered records for non-blocking and stream file sinks. [#255, #257]

@​logtape/otel

• Fixed OpenTelemetry sinks losing their asynchronous cleanup hooks in browsers without Symbol.asyncDispose, including Safari. reset() now waits for provider shutdown, and configureSync() correctly rejects these asynchronous sinks. [#255, #257]

@​logtape/redaction

• Fixed redactByField() dropping sink cleanup hooks in browsers without Symbol.dispose or Symbol.asyncDispose, including Safari, preventing

... (truncated)

Commits

• 55d2555 Merge tag '2.3.12' into 2.4-maintenance
• 2e8be9c Merge tag '2.2.15' into 2.3-maintenance
• b1ad1fb Merge tag '2.1.19' into 2.2-maintenance
• 8680235 Merge tag '2.0.28' into 2.1-maintenance
• 917f37f Fix Safari disposal hook classification
• 92941ec Version bump
• 86515a4 Version bump
• 1880dd6 Version bump
• 5b4d1fa Version bump
• 3856593 Version bump
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T22:49:29.794550Z	9dc3ce0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates the locked version of LogTape from 2.4.0 to 2.4.1.

Example: Install Poltergeist dependencies with pnpm's frozen lockfile.

• Before: The lockfile resolves @logtape/logtape 2.4.0.
• After: The lockfile resolves @logtape/logtape 2.4.1 with its published integrity hash.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The focused patch has matching package integrity, compatible upstream changes, and successful CI, but direct production logging coverage remains limited.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot-authored dependency PR is outside the ordinary contributor proof gate; green CI supports compatibility but does not establish a production LogTape logging run.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes
User problem: No current Poltergeist failure is demonstrated; the update incorporates upstream disposal compatibility repairs.
Reason: The small update follows the repository's established compatible-dependency maintenance pattern without changing user choices or adding a new capability.

Merge readiness

✅ Ready for maintainer review

Keep this PR open as a focused, compatible dependency update; no actionable defect was found, and all seven checks passed for the reviewed head.

Priority: P3
Reviewed head: 9dc3ce05196cfe54a68dd765c9a9ba34ec044aba

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: Existing logger tests select SimpleLogger, and CLI help/version checks do not demonstrate production LogTape logging with 2.4.1.

Agent review details

How this fits together

Poltergeist's logger receives CLI and daemon messages, selects LogTape or SimpleLogger, and writes formatted output to the console or a log file.

flowchart LR
  A[CLI and daemon] --> B[Logger factory]
  C[Locked LogTape package] --> B
  B --> D[LogTape logger]
  B --> E[SimpleLogger fallback]
  D --> F[Console and log file]
  E --> F

Loading

Technical review

Best possible solution:

Land the focused patch update through the repository's normal dependency review.

Do we have a high-confidence way to reproduce the issue?

This PR reports no Poltergeist bug; the upstream Safari disposal failure is documented, but Poltergeist targets Node 24+ and does not use the reported configureSync() path.

Is this the best way to solve the issue?

A lockfile-only patch update is appropriately narrow, preserves the declared dependency range, and introduces no configuration, API, or persistence changes.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against f9264c5c3bba.

Provenance checked

• LogTape lockfile resolution keeps the original intent (456b657: The merged refresh selected compatible runtime dependencies, including LogTape 2.4.0, while retaining the existing runtime and tooling constraints.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Verified PR scope: The pinned introduction diff changes only the importer version, package integrity entry, and snapshot key in pnpm-lock.yaml; the existing ^2.4.0 requirement remains intact. (pnpm-lock.yaml:19, 9dc3ce05196c)
• Production dependency boundary: src/logger.ts loads LogTape and uses configure() with a console sink; tests explicitly select SimpleLogger. This runtime dependency provides the affirmative reason to inspect LogTape's implementation and compatibility contract. (src/logger.ts:183, f9264c5c3bba)
• Upstream patch compatibility: The 2.4.0-to-2.4.1 core diff replaces disposal-symbol accesses with native-or-registry symbols without changing public API signatures or adding runtime dependencies; the upstream report and merged fix are configureSync() throws “Async disposables cannot be used with configureSync()” in Safari when getThrottlingFilter() is used dahlia/logtape#255 and Fix disposal hooks when disposal symbols are missing dahlia/logtape#257. (packages/logtape/src/disposable.ts:4, 9a13aabe3031)
• Published package metadata: npm's 2.4.1 metadata identifies dahlia/logtape as the source repository, declares no runtime dependencies or install hooks, and supplies the same SHA-512 integrity value used by this PR.
• Current validation: All seven check runs succeeded at the reviewed head, including Node 24 CLI checks on Linux and macOS, Windows checks, coverage, formatting, and security scanning; the PR is reported mergeable and clean. (.github/workflows/ci.yml:31, 9dc3ce05196c)
• Existing dependency intent: The merged dependency refresh at build(deps): refresh eligible dependencies and source-map security fix #270 established the current LogTape 2.4.0 resolution as compatible dependency maintenance; this patch continues that approach. (pnpm-lock.yaml:19, 456b657d8b46)

Likely related people:

• Peter Steinberger: Raw commit 0e1fb9b adds pnpm-lock.yaml:11 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 0e1fb9be581d; files: pnpm-lock.yaml)

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is routine dependency maintenance with no demonstrated current Poltergeist outage or regression.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (2 earlier review cycles)

• reviewed 2026-10-13T22:52:27.272Z sha 9dc3ce0 :: needs maintainer review before merge. :: none
• reviewed 2026-10-14T01:19:15.024Z sha 9dc3ce0 :: needs maintainer review before merge. :: none

Reviewed October 14, 2026, 4:35 AM ET / 08:35 UTC (Revision 3).